|Publication number||US5408649 A|
|Application number||US 08/055,849|
|Publication date||Apr 18, 1995|
|Filing date||Apr 30, 1993|
|Priority date||Apr 30, 1993|
|Also published as||US5621884|
|Publication number||055849, 08055849, US 5408649 A, US 5408649A, US-A-5408649, US5408649 A, US5408649A|
|Inventors||Norman J. Beshears, Douglas Flanagan, Peter Y. Kui|
|Original Assignee||Quotron Systems, Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (36), Referenced by (141), Classifications (25), Legal Events (10)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The invention described later in detail relates to distributed data access systems with a plurality of computers that afford database access to a group of geographically distributed users. More particularly, the invention concerns a distributed data access system having a plurality of computers with 1-for-N redundancy in which one of the computers is operated on a standby basis, ready to assume operation of any of the other computers in the event of failure in that computer.
The invention operates in a system that provides a variety of financial data services to subscribers through terminals that access a financial information database. In a prior system, trading information from various stock exchanges, news information from news services, and other information from private databases was transmitted over conventional means to each of a plurality of regional communication centers (RCC). The RCC's were geographically distributed throughout the United States, each serving to assemble and archive securities trading information, news service information, and private database information, and to distribute archived information through one or more concentrators to local users within the geographical area served by the RCC. For example, Quotron systems, Inc., the assignee of this application, has maintained a financial information distribution network (the "QSI" network) including seven regional communication centers and over 200 concentrators in 50 different locations, all serving 5,000 users through 80,000 desk units.
Each RCC included at least one computer facility referred to as a regional computer (RC). Each RC comprised at least five computers connected together by a high speed channel. Two computers in the RC performed communication services, while at least three computers were provided for file services. Some RC configurations included six computers in which two were communication servers and four were file servers. In order to meet reliability, availability, and speed requirements, each RC architecture embraced 1-for-1 redundancy for each computer in the RC. Thus, an RC with six computers needed 12 computers in order to satisfy the redundancy requirements. In the QSI network, there were 45 RC's.
In order to reduce significant overhead expenses, including communication, equipment, and network costs, a system architecture has been proposed to consolidate the seven RCC's of the QSI network into a single, national distribution center. In order to reduce the complexity and potential downtime involved in changing to a single, national center, the seven regional partitions were retained. In the national center, one or more of the RC's is implemented in a respective one of a plurality of computer facilities. Each replacement computer facility is referred to as an XRC. The significant technological challenge in establishing and operating the national center with over ten XRC's was to provide stability and reliability of the flow of information in the event of XRC failure.
The invention achieves the requirements of stability and reliability in a distributed data access system including a plurality (N) of database computer facilities with 1-for-N redundancy. In this regard, a single database computer facility is provided on a standby basis permitting complete assumption by that standby computer facility of operation of any one of the plurality of computer facilities in which a failure is detected. The 1-for-N redundancy architecture of the invention avoids the considerable expense of the 1-for-1 redundancy which was required in the RCC architecture of the prior art.
The 1-for-N redundancy architecture of the invention also includes an arbitrator computer facility coupled to all of the database computer facilities. The arbitrator computer facility includes the ability to detect failure of any one of the database computer facilities and substitute the spare database computer facility in place of the failed one.
FIG. 1 is a block diagram illustrating the architecture of a distributed data access system with 1-for-N redundancy according to the invention.
FIG. 2 is a block diagram illustrating in greater detail the architecture of a node of the system of FIG. 1 and its connection with a communications set.
FIG. 3 is a block diagram illustrating a first set of data structures used in the invention.
FIG. 4 is a block diagram illustrating a second set of data structures used in the invention.
FIG. 5 is a block diagram illustrating architecture for monitoring the state of health in a computer facility of the system of FIG. 1.
FIG. 6 is a block diagram illustrating the architecture of computer software used to practice the invention.
FIG. 7 is a flow diagram illustrating the major processing tasks executed by the arbitrator computer facility.
FIG. 8 is a flow diagram illustrating a switch-over process executed by the arbitrator computer facility.
FIG. 9 illustrates a data structure used by the arbitrator computer facility.
A financial information system providing distributed access to a financial database is shown in schematic form in FIG. 1 and includes information sources such as a national computer center 10 and other information sources, two of which are indicated by reference numerals and 12. The national computer center 10 includes a facility called a "ticker plant" which receives securities market data, processes the data, formats it, and then distributes it or broadcasts it via market feeds to the regional computers in the form of securities market information denoting the identity of a security and related transactional data such as price bid, price asked, selling price, lot size, and so forth. The invention does not encompass a ticker plant, but the information to which it provides access is presumed to have a structure imposed by a ticker plant. As is well known, such information is accessed by a plurality of geographically distributed equipments ("users") on the basis of security symbols.
Access to the information is provided by a plurality (N) of database computer facilities denoted as XRC1-XRCN. Each database computer facility maintains a current securities market database in which all security transaction information provided by the national computer center 10 is maintained and accessed by means of security symbols. The databases, which are identical, are denoted as DB1-DBN. A spare database computer facility (XRCSP) is maintained in a standby mode and includes a securities market database (DBSP) which is identical with the databases DB1-DBN. The system includes an arbitrator computer facility including a first arbitrator computer (ARB1) and a second arbitrator computer (ARB2). All of the database computer facilities, the spare computer database facility, and the arbitrator computers are interconnected for message-based communications by redundant routers denoted as ROUTER 1 and ROUTER 2. As shown in FIG. 1, ROUTER 1 includes a plurality of ports as does ROUTER 2. All of the XRCs, including the standby XRC, are connected to a first plurality of ports on ROUTER 1. Each of the arbitrator computers is connected to a respective port on a ROUTER 1. A second plurality of ports on ROUTER 1 is provided for connection to user sets. Each entity connected to a port on ROUTER 1 is also connected to a respective port on ROUTER 2.
The routers are conventional devices. Preferably, each router may comprise a corresponding product available from cisco Systems, Inc. The routers provide inter-computer communication based on the well-known transmission control protocol/internet protocol (TCP/IP). In this regard, each XRC, arbitrator computer, and user network may be uniquely identified by a gateway address identifying the router port to which it is connected. Provision of the gateway address in a formatted message enables a router to communicate a message received through one port to the port identified by the gateway address. Accordingly, the XRCs communicate with the arbitrator computers and with the user sets at the network level. This invention does not concern network communication, and it is asserted that the network interfaces are LAN based and are, therefore, conventional.
As FIG. 1 shows, each user set is accessed through a respective one of the second plurality of ports by way of a LAN (local area network)-based architecture. For example, communication of information to the user 21 is by way of the port 13, the LAN 14, a terminal server 16 which is connected to the LAN 14, and a concentrator (CONC) 18, which is one of a plurality connected to the terminal server 16. Thus, each user can be logically addressed by the concatenation:
PORT: TERMINAL SERVER: CONCENTRATOR: USER id In the system of FIG. 1, user sets are established such that any particular user set is accessed through, and, therefore, defined by, the router port to which it is connected. Thus, all of the users which access ROUTER 1 through port 13 form a user set. In the system of FIG. 1, each user set is served by one respective XRC. Therefore, there is a 1-to-1 mapping from an XRC to a user set and from a user set to an XRC. For example, in FIG. 1, assume that the user set accessed through port 13 of ROUTER I is identified as user set 1 and is assigned to XRC 1. In this case, all communications to the users of user set I would be routed through XRC I and XRC 1 would communicate with no users save those in user set 1.
In the system of the invention, a user set implicitly defines a communication server set. A communication server set includes a first list of all terminal servers which provide access to the server set. In FIG. 1, this first list would include the terminal servers 16 and 17 and all other terminal servers necessary to access the users of user set 1. The communication server set also includes a second list of terminal servers through which the user set obtains information from auxiliary information sources such as the sources 11 and 12 in FIG. 1. Such auxiliary sources may include private databases of enterprises which subscribe to the securities market information provided by the national computer center 10. Other information sources may include, for example, news services. Such auxiliary information sources are identified with regional nodes such as the regional nodes 25a and 25b which represent database computer facilities that organize and maintain databases through which information from the respective auxiliary information sources is obtained. The regional nodes of a communication server set are connected by way of one or more terminal servers such as the terminal 26 through a single port of a router such as port 27 of ROUTER 1.
FIG. 2 illustrates the architecture of XRC 1, with the understanding that this architecture is substantially identical to the architectures of all of the XRCs, including the spare one. XRC1 embraces a communication processor (CP) 210, a file processor (FP) 214, an update server for securities information updating (CSVR) 216, and an Xstation (XS) 217. The components of the XRC are connected together conventionally for communication on a local area network (LAN) 218. The LAN 218 is also connected to the port 24 of ROUTER 1, which is identified by the gateway address for XRC1. The communication processor 210 is dedicated to the XRC1 and handles routing of all messages to and from users which define the communication server set to which XRC1 is mapped. In order to perform message switching to either the file processor 214 or to the regional nodes accessed through the terminal server 26, the communication processor 210 maintains a database 211 including four data structures of interest. The first data structure, entitled MONITOR ID, lists, by symbol, securities for which coded MONITOR requests have been received from the user set. MONITOR ID is used in the best mode of the invention to map numeric codes to ASCII symbol representations. Thus, the XRC may transmit trading activity off of a monitored symbol by identifying the particular security by its numeric code. The communications processor 210 maps the numeric code to the security symbol by way of the MONITOR ID data structure. The second data structure is entitled MONITOR BIT MAP. The MONITOR BIT MAP is a table of bits with one bit for each possible user in a common server set. There is a bit map for each service provided on each exchange for each symbol. Thus, for each symbol, there is a bit map for each service on each exchange on which the security trades. The third data structure is a user directory which lists all users of a user set which have transmitted SIGN ON messages to XRC1. The fourth data structure is a configuration set which lists for each terminal server in the communications server set particular parameters affecting communications conducted for the terminal servers. Two such parameters would include, for example, baud rate and message format. Hereinafter, these data structures are referred to as "connectivity data structures".
The file processor 214 maintains a security market information database 215 in which security market transaction information is stored and indexed by security symbol and exchange. Included in each record in the database is the monitor ID for that symbol if an ID exists. Also included is a bit for each monitor service type. A bit is set if any user is using that service to monitor activity on that symbol.
The communication server 216 is dedicated to XRC1 and provides connection to update lines connected to the national computer center 10.
The Xstation 217 provides an XRC manager with access to the components of XRC1 by conventional input/output means, including a conventional menu-driven interface connected by known means to a QWERTY keyboard, a pointing device, and a display screen.
FIG. 3 illustrates the connectivity data structures maintained by the communication processor 210 of XRC1 and by all on-line XRC's. The monitor id structure 310 has the format illustrated in FIG. 3, which maps selected symbols in a set of security symbols to a unique multi-bit code employed by regional systems to identify symbols. The mapping from monitor id 310 is to a symbol directory in the user bit map structure 311 contains an entry for each security received on the market feeds via the update server. For each security in the symbol directory there is a list of exchanges on which the security trades various types of data (or services) are available for each trade. Thus, there is a user bit map for each service. Each entry in the user directory 312 includes, in the USER field, an ASCII code identifying a user followed by a bit-wide field which is set when a user signs on and reset before sign on and after sign off. There is also a pointer to routing data structure which defines the communication route to the user through the router port allocated to the user set. In this regard, the routing data structure includes, at a minimum, the identification of a terminal server (TS), a terminal server port, and a concentrator line (CLINE). Relatedly, the terminal server identification maps to one of the terminal servers which support the users in the user set. Each terminal server includes a plurality of nodes for serial connection to a respective concentrator. Therefore, identification of a port identifies a concentrator. Similarly, each concentrator includes one or more lines, each of which is connected to a computer, processor, or terminal identified as a user. Therefore, identification of the concentrator line (CLINE) identifies the path between the concentrator and a user and, by implication, the user. The configuration set data structure 313 lists, by terminal server (TS), the communication parameters (PARMS) and parameter values which must be observed in communications with the identified terminal server. FIG. 4 illustrates the data structures in the database of an XRC file processor. A monitor id field indicates whether a particular security identified by a symbol has a monitor id. Each entry also includes a bit map with a bit for each type of service which may be monitored.
Refer now to FIGS. 2, 3, and 4 for an understanding of certain communications protocols in the system of FIG. 1. Initially, a user in the user set served by the XRC1 will send a SIGN ON message including a preamble with a routing data structure for the user. The SIGN ON message is routed to the communication processor 210 which sets the active bit for the user and enters the routing data structure in the user directory 312. Now, the communication processor can respond appropriately to any message received from the user. In this regard, the user may send inquiries about securities identified in the inquiry messages by security symbol and exchange. The communication processor transmits the inquiry messages to the file processor 214, seeking the requested transaction data. The file processor returns the data to the communication processor, which forwards the data to the requesting user, using the routing data structure in the user directory 312. Assume that a user transmits a MONITOR ADD message, signifying that all market activity for an identified security is to be provided continuously to the user as it becomes available. Upon receipt of a MONITOR ADD message, the communication processor sets a bit in the monitor bit map entry for the symbol which corresponds to the user. The MONITOR ADD request is then forwarded to the file processor which sets the corresponding bit in the monitor service bit map which it maintains by security. Now, each time an updating transaction for the security is received, the file processor 214 will forward the information to the communication processor 210 who will then place the information in a respective message for each user whose bit is set in the security's symbol entry of the monitor bit map 311. In the message sent to the user, the symbol is identified by the monitor ID entry if one exists.
Assume next that a user who has signed on transmits a NEWS message, requesting news concerning a particular security. The communication processor 210 obtains the security symbol via the database structure 310, identifies the regional node through which access to the necessary information source is obtained, and the terminal server serving that node, from the communication server set. The request is then dispatched via tile identified terminal server and the response received by the communication processor 210 is forwarded to the requesting user.
With this explanation, it should be clear that, in the event of a failure in XRC1, the spare XRC can be substituted in place of XRC1 by configuring it with at least the connectivity data structures illustrated in FIG. 3. The arbitration scheme of the invention, implemented in the arbitration computer facility, ensures that these functions are performed by periodically polling the on-line XRCs as to their state of health (SOH), by periodically checkpointing the communication processor databases of the on-line XRCs, and by configuring the spare XRC for operation when a failure is detected by providing it with the connectivity data structures of the failed XRC.
State of health is monitored in each XRC in order to allow timely detection of hardware or software malfunctions in any given component of the XRC and to report such malfunctions to the arbitrator computer facility. This is illustrated in FIG. 5 which shows the SOH architecture for an XRC. The XRC includes an XRC node supervisor 500 with a state of health monitor process 511 and a database checkpoint process (DBCHKPT) 512 coupled to the communication processor database 510 of the XRC. The state of health monitor process 511 is coupled to a respective task monitor in each XRC component. One such task monitor 515 is shown in FIG. 5. The task monitor 515 reports alarms (516) which indicate either process termination or degradation in executing tasks, including the tasks 517 and 518. The state of health monitor 511 is also coupled to a message queue monitor in each XRC component. One such monitor is indicated by reference numeral 525. The monitor 525 reports available queue space (526) in queues including input queue 527 and output queue 528. The XRC node supervisor is a process that executes in a designated component of the XRC; it communicates state of health by message with the arbitrator computer facility.
Preferably, the state of health monitor 511 dynamically monitors all critical software processes in every processor, attempts to restart terminated processes, and reports the inability to restart any process. In addition, all software processes are monitored for the occurrence of built-in alarms, each alarm occurrence being reported. Queue monitors observe message queue loading in every processor so that a process using a queue will not wait indefinitely if a queue is full. In the preferred embodiment, a queue is deemed full if 98% utilized, and a queue is deemed to fail if full for three successive monitor periods. The state of health monitor 511 is located in a particular processor of the XRC and exchanges handshake messages with task and queue monitors in the XRC. This message traffic provides a third state of health parameter which can be quantified by, for example, the number of collisions on the XRC's LAN.
The state of health monitor 511 calculates an XRC state-of-health value which is a relative weighted value expressed in percent of a maximum value. In the preferred embodiment, the state of health is maintained as a maximum value of 10,000. This value is reduced by a predetermined fixed value for each alarm recorded by a task monitor or a queue monitor. The current value is maintained by the state of health monitor 511 and periodically reported to an arbitrator computer in response to an XRC poll.
The node supervisor 500 also comprehends the database checkpoint process 512. This process provides for the copying of shared memory to a local disk and remote copying to an archive database in the arbitrator computer facility. The process 512 works conventionally in conjunction with database routines (not shown) to provide an abbreviated naming convention for naming files. The database checkpoint process of each XRC is programmed to periodically transfer shared memory segments to the archive database. The transfer process is a remote calling process (RCP) conducted through the transport layer in the operating system software of an arbitrator computer. When an XRC is in an on-line status, its database checkpoint process will periodically name and transfer the connectivity data structures described above and illustrated in FIG. 3. These structures are saved in the arbitrator computer facility for XRC switchover in case of failure.
FIG. 6 illustrates functional components of the system of FIG. 1 which implement the invention. These functional components represent the computer programs and routines which are executable on the XRC's and arbitrator computers, as well as databases maintained at the arbitrator computer facility. The computer programs and routines are written in the well-known C language and are compiled and executed on their respective computers.
The architecture of FIG. 6 illustrates the structure of, and interconnections between, a single XRC 600 and an arbitrator computer 605, with the understanding that these are representative for all XRCs and both arbitrator computers. As described earlier, the XRC 600 executes a node supervisor process 602. The node supervisor 602 forms the primary interface between the state of health functions and the communication processor database of the XRC 600 on the one hand and the arbitrator computer 605 on the other hand. In the arbitrator computer 605, a node manager process 607 interfaces with the node supervisor 602. A polling process 608 (XRC13 POLL) periodically polls the XRCs for state of health information. Other processes which execute on the arbitrator computer 605 and which are of interest in understanding the invention include a configuration process 609 (CONFIG), an arbitration process 610 (ARB-- UNIT), and an operation/command interface 611 (OP-- CMD-- IF). A DUPLEX process 612 interfaces with the other arbitrator computer in a manner described later. A message queue 614 supports conventional message-based interprocess communication in the arbitration computer 605. The arbitrator computer facility maintains two databases, an XRC database 613, and an archive database 616. The XRC database 613 is updated by two routines in the node manager process 607 and by the configuration process 609. The archive database 616 is updated by the on-line XRCs, using remote call procedures invoked by their respective database checkpoint process. Although both arbitrator computers can access these data bases, only the active one can read and update them.
The configuration process 609 provides for defining communications server sets. Each communication server set includes, at a minimum, the two terminal server lists as described above. Each set further includes the configuration of each terminal server listed. Each terminal server is configured by specifying the line type and speed of each of its serial ports. The line types identify particular regional nodes or concentrators. The arbitration process 610 downloads a configuration to an XRC upon initial installation, upon restart, or upon the XRC assuming control for a failed XRC. The initial configuration includes a communication server set, the state of health polling rates and the database checkpoint frequency. The configuration enables the XRC to determine which user set and which terminal servers it is servicing. The XRC creates its configuration set from the downloaded configuration. The user directory, monitor id data structure, and the monitor bit map structure are accumulated by the XRC as it services its user set. The arbitration process 609 maintains a data structure 615 in the database 613. The data structure is essentially a table in which each entry includes a field (XRC) to identify an XRC, a field (SOH) for containing a value corresponding to the state of health of the XRC, a field (MODE) indicating the mode of operation of the XRC, a field (CM SET) identifying the communications server set assigned to the XRC, and a field (FLG) containing a flag having a purpose discussed below.
The node manager process 607 provides a software interface between the arbitrator computer and XRCs. Three routines are included in the node manager 607: SIGN ON 607a, ARB-- 2-- XRC 607b, and XRC-- 2-- ARB 607c. The SIGN ON function processes the signon from each XRC as it connects to the arbitrator computer. When an XRC signs on, the XRC database 613 is updated with an entry for the XRC. The XRC is given a tag which is placed in the XRC field of the table 615 and an entry is made in a socket table 607d showing the communication path between the arbitrator computer and the XRC. The XRC can then be referenced by the tag and the correct socket can be found, given the tag. The ARB-- 2-- XRC function 607b handles all communications to an XRC specified by a tag. All XRC-bound messages are given to this function for delivery to the XRC. The messages sent from the arbitrator computer to an XRC include:
go ON LINE
The XRC-- 2-- ARB routine 607c receives all traffic from XRC's other than signon requests. These messages include:
go ON LINE completed
go STANDBY completed
Information in message traffic from XRCs is recorded in the XRC database 613. The information is available to any process that accesses the database.
The XRC-- POLL process 608 periodically generates a sequence of polling messages. Each is transmitted as a request state-of-health message to a respective XRC. The list of XRCs to poll is found in the XRC database 615. The XRC-- POLL process also is provided with the completion status of file transfer from the XRCs to the archive database 619 and maintains a status log for such information.
The ARB-- UNIT process 610 analyzes the state of health of each XRC based upon the information stored in the XRC database 613. The health information is in the SOH column of the table 615. Based upon the SOH for any XRC, the ARB-- UNIT process 610 will initiate a switchover to a spare XRC when necessary.
An interface to a user is provided by the operator command interface process 611. This interface provides a user with monitor, control, and configuration capabilities. The interface is menu-driven, providing a user with, among other functions, monitoring XRCs, examining the XRC database, manually executing an XRC switchover, inspecting or modifying arbitrator computer facility parameters, displaying arbitrator computer status, and manually configuring communication server sets.
Last, the DUPLEX routine 612 provides state-of-health monitoring of each arbitrator computer of the arbitrator computer facility and determines which one of the arbitrator computers will perform an active role, and which will be standby.
The XRC database 613 is updated by the SIGNON routine 607a, by the configuration process 609, by the XRC-- 2-- ARB routine 607c, and by the ARB-- UNIT process 610. The archive database 619 is updated by a remote storage procedure (RCP) invoked by the database checkpoint processes in the XRCs. For each XRC, a periodic RCP is invoked to store the connectivity data structures maintained by the XRC; as described above, these include the monitor id, monitor bit map, user directory, and configuration set structures for the XRC. When stored in the archive database 616, these data structures are referred to as "checkpoint data". The checkpoint data for each XRC is stored in the archive database in a file set 620 which is indexed by XRC entries in a directory 621.
Assuming initial setup and configuration of a system according to FIG. 1, an arbitrator computer designated as the active one will assume responsibility for redundancy processing. In redundancy processing it is assumed that there are N XRCs operating in a mode referred to as "online" in which each serves a particular user set by providing securities information and monitoring designated securities as described above. In this regard, the communication processor for each online XRC will maintain a communication processor database as described above including, at least, the monitor id, monitor bit map, user directory, and configuration set data structures described above. One XRC is operated in a standby mode and designated as a spare. Upon failure of any online XRC, the spare XRC is brought online to service the communication server set of the failed XRC. When the failed XRC is repaired, it becomes a spare. The determination of XRC failure and the switchover processing necessary to take a failed XRC off line, to configure a standby XRC to substitute for the failed one, and to switch the standby XRC over to online operation are performed by the active arbitrator computer. In this regard, the active arbitrator computer detects the failure of an XRC and proceeds with switchover. In the preferred embodiment, an operator can also request switchover through the active arbitrator computer.
The process steps executed by the active arbitrator computer for monitoring and switchover are illustrated in FIG. 7. Initially, the arbitrator computer periodically polls all online XRCs and the standby XRC as to their states of health (SOH) in step 701. The state of health data is entered into the XRC database 613. In parallel with state of health polling, the XRCs periodically store their checkpoint data in the archive database of the arbitrator computer facility. The results of state of health polling are evaluated in step 703 using the XRC database 613 to determine whether any XRC exhibits a failure. Relatedly, a failure is deemed to occur whenever the reported state of health value for any XRC falls below a predetermined threshold. For so long as no online XRC exhibits failure, the active arbitrator computer executes a loop including steps 701 and 703. In the event that XRC failure is detected in step 703, the active arbitrator computer executes a switchover process in which the latest checkpoint data for the failed XRC is provided to the standby XRC while the failed XRC is shut down and the standby XRC is given online status. This processing is represented by step 705 in FIG. 7 and is executed using the archive database 616 of the arbitration computer facility.
Switchover processing is illustrated in greater detail in FIG. 8. In FIG. 8, an evaluation loop including steps 800-806 is executed for each XRC each time the XRCs are polled as to their state of health. In this regard, step 800 counts the loop down for all of the XRCs including those with online and standby status. For each state of health request, a timeout is started in step 801. Assuming receipt of a response before the timeout is completed (step 803), the state of health parameter values for the XRC are entered into the XRC database and evaluated in step 805. When the last XRC polling message has been sent, the loop is exited. The loop then begins again with another polling sequence which begins after expiration of a prescribed interval.
In FIG. 8, if the timeout expires before an XRC provides a response or if the reported state of health value for the XRC is below the acceptable threshold, a failure is detected in step 810 and a shutdown message is sent to the failed XRC in step 811. This causes the failed XRC to close its connections to all of its terminal servers. Next, in step 812, the active arbitrator computer readies the spare XRC by downloading to it the latest checkpoint information stored in the archive database by the failed XRC. The active arbitrator computer will also force the terminal servers to disconnect from the failed XRC. In step 813, the standby XRC is sent a GO ONLINE message, in response to which it activates all necessary processes and routines. In step 814, the spare XRC undertakes any steps necessary to connect with the terminal servers in its communication server set when the process is exited. In this step, the XRC also configures its communication processor database by placing in it the connectivity data structures and configures its file processor database by forwarding to its file processor MONITOR requests for all securities whose symbols are included in the monitor list of the communication processor database. When all of its processes and routines are activated and any necessary connections are made, the standby XRC switches its internal mode to online and sends a GO ONLINE COMPLETED message to the arbitration computer in step 815. From this point, the (formerly) standby XRC serves the user set of the failed XRC as described above.
The frequency with which the loop 800-806 is executed is referred to as the "polling frequency". The polling frequency is programmed at the arbitrator computer facility and may be set at a rate which satisfies the reliability considerations of a particular design.
In the context of the software architecture illustrated in FIG. 6, the steps of FIG. 8 are executed as follows: the XRC-- POLL process 608 periodically executes a polling sequence by generating a sequence of polling messages, each destined for an identified XRC. The sequence of state of health request messages is placed on the message queue 614 and sent one-by-one by the ARB-- 2-- XRC process 607b. Responses include state of health values are received by the XRC-- 2-- ARB process 607c which places the state of health parameter value for each XRC at the appropriate location for that XRC in the table 615. The ARB-- UNIT process 610 is synchronized to the polling frequency in order to provide XRC management and assignment of user sets to the XRCs and to conduct the switchover processing illustrated in FIG. 8. This process runs periodically and examines the XRC database for active user sets. In this regard, for each user set, the process 610 determines if there is an XRC assigned to it, and if the XRC is in good health. If the XRC is in good health and has been assigned a user set (inferred from an entry in the CM SET field of the entry) its mode field is marked ONLINE. If the XRC state of health value is above the threshold but its CM SET field is empty, its MODE field is marked STANDBY. In addition to maintaining the MODE and CM SET fields of the XRC table entries, the ARB-- UNIT process 610 performs the timeout and state of health evaluations of steps 803 and 805 of FIG. 8 and, if necessary, the switchover processing of steps 810-815. In this regard, assume a positive exit from decision 803 or a negative exit from decision 805. In step 810, the process 610 will reset the MODE field of the failed XRC from ONLINE to OFFLINE and will scan the XRC table 615 for an XRC in STANDBY operation mode. When a standby XRC is identified, it will be assigned the user set of the failed XRC by entering into its CM SET field the identification of the communication server set embracing the user set. While the switchover is occurring, the flag (FLG) field of the standby XRC is set to prevent the XRC from being selected for another user set. The flag will be reset upon the XRC transitioning to ONLINE mode and sending a GO ONLINE COMPLETED message. The ARB-UNIT process 610 will then reset the mode field for the XRC from STANDBY to ONLINE.
The method of the invention, which is implemented in the switchover process of FIG. 8, provides 1-for-N redundancy in that a single XRC can be operated in STANDBY mode as a potentially redundant instantiation of any online XRC. When failure is detected in an online XRC, the standby XRC is made fully redundant by downloading to it the appropriate connectivity data structures described above from the archive database. Manifestly, reliability considerations of any particular design may require the provision of more than one standby computer. In such instances, the architecture and procedure of the invention would still be applicable.
Referring, again, to FIG. 1, it will be appreciated that the reliability of the 1-for-N redundancy provided by the invention is enhanced by the dual arbitrator computer architecture which the figure illustrates. The dual arbitrator computer architecture is operated in a duplex mode in which the arbitrator computers are essentially identical and one arbitrator computer assumes the active role of arbitrating the health and status of the XRCs, while the other stands by. In this regard, as the software architecture of FIG. 6 shows, each arbitrator computer includes a duplex process (indicated by reference numeral 612 in FIG. 6). The duplex process implements a redundancy supervisor in the arbitrator computer facility that provides state-of-health monitoring of each arbitrator computer and determines which will be assigned the active role. Relatedly, with reference to FIG. 6, the duplex process 612 is coupled for LAN-based communications through the router configuration illustrated in FIG. 1 with the second arbitrator computer, which is indicated by reference numeral 624 in FIG. 6. The duplex process is also connected to a task monitor process 622 and an alarm manager process 623 in the arbitrator computer 605. The duplex process 612 is enabled by the task and alarm manager 622 and 623 to determine the state of health of its arbitrator computer by monitoring task activity and alarm occurrence. The duplex process 612 calculates a state of health value in response to task failure and alarm occurrence reported by 622 and 623. In the preferred embodiment, the occurrence of a single alarm deemed critical will force the state of health measurement to a value which can cause a switchover. If two or more critical alarms occur, a switchover is forced. If any critical process dies and cannot be restarted, a switchover also is forced.
The duplex processes executing in each of the arbitrator computers 605 and 624 implement a duplexing algorithm. Initially, when both arbitrator computers start, they establish communications between themselves with a socket connection in each direction. Any arbitrator computer accepting a connection will use the related socket for receiving a handshake, and when it connects a socket to the other arbitrator computer, it will use that socket for transmitting a handshake. The handshake has the structure illustrated in FIG. 9 and consists of a STATUS byte and a state of health value (SOH). The STATUS byte has three initial bits MODE, S/D, and WAR. The MODE bit is set to indicate whether the arbitrator computer is active or standby, the S/D bit is a simplex/duplex indicating whether the connection to the other arbitrator computer is established. The WAR bit indicates that the arbitrator computer thinks there should be a WAR to establish the mode. The STATUS byte also includes a WAR value field for containing a four-bit randomly generated number. The state of health field contains a weighted value indicating what the arbitrator computer measures as its own relative health. Each arbitrator computer has a personal "name" which is an appropriate code identifying it. It is asserted that in the system of FIG. 1, name assignments for each XRC and arbitrator are generated at system set up by an operator. In addition, each XRC is provided with a "well-known name" that the XRCs will use to establish connections with an arbitrator computer. The "well-known name" is used by an XRC to obtain the network address of an arbitrator from a name server (not shown). Using the well-known name, the name server will supply the network address of each arbitrator. The XRC will try both arbitrators to assure it connects to the one which is master. The arbitrator computer not designated as active will send a STATUS byte with the WAR bit set and a WAR value of zero to force the other arbitrator computer to accept the active role. Once the initial mode of each arbitrator computer is established, the arbitrator computers periodically exchange handshakes. Each arbitrator computer monitors the received handshake. Each received handshake is monitored to be sure that it is received within a predetermined time period of the preceding handshake. Handshakes are further monitored to ensure that the active arbitrator computer has a state of health exceeding a predetermined threshold or exceeding the state of health of the standby arbitrator computer. If three handshakes in a row are missed by either arbitrator computer, it will take appropriate action dependent upon its operating mode. The arbitrator computer which is active will set its S/D bit to simplex, and either continue to send its handshake or try to reconnect its socket to the other arbitrator computer. If the standby arbitrator computer detects three handshake misses by the active arbitrator computer, it will assume the active mode, set its S/D bit to simplex, and try to reestablish communications with the other arbitrator computer.
Only the active arbitrator computer will respond to connection requests from XRCs. Only the active arbitrator computer will perform the processing described above in connection with FIGS. 7 and 8. Each on line XRC will periodically upload its archive database to the active arbitrator. The active arbitrator then transfers these files to the standby arbitrator. At a more frequent interval, the active arbitrator sends the XRC database to the standby arbitrator.
If either the active or the standby arbitrator computers see that the active arbitrator computer is failing in health, either can attempt to force a switchover. If the switchover is successful, the standby arbitrator computer will become active and will initiate a process forcing all of the XRCs to sign on to it. Once this occurs, the arbitration computer facility operates in a simplex mode until the failed arbitrator computer is repaired.
Each of the XRC nodes (1 through n) establishes which arbitrator it expects to be active. Upon a software connection to the assumed active arbitrator, the arbitrator will begin normal communications with the XRC node if the arbitrator is really the active one. If the arbitrator is the standby, it will send a message to the XRC node to inform it to use the other arbitrator (i.e., the active one).
If the arbitrators are operating in simplex mode, the active one will continue to be active and support all XRC's which connect to it. Thus, it is possible that both arbitrators are active in simplex mode. When the software connection between the arbitrators are re-established, the war? resolution will determine which is active.
Referring once again to FIG. 1, the architecture of the system of the invention provides for duplexed, redundant routers identified in FIG. 1 as ROUTER 1 and ROUTER 2. The routers are identical in all respects and connections to router ports are identical as shown in FIG. 1 by the connection of XRC 1 to port 24 and ROUTER 1 and to the corresponding port 24a on ROUTER 2. FIG. 1 also illustrates ports 13a and 27a on ROUTER 2 which correspond to, and are connected in parallel with, ports 13 and 27, respectively, of ROUTER 1.
During normal operation, assume an XRC on a first LAN connected to port 24 of ROUTER 1 communicates with ARB 1 on a LAN connected to port 30 of ROUTER 1 with ROUTER 1 serving as intermediary between the LAN's. The conventional architecture and operation of ROUTER 1 enables it to determine that the packets placed on the LAN and received at port 24 should be forwarded to the LAN connected to port 30. In the conventionally-available router products, such routing takes place at the IP addressing level beneath which the link layer (ETHERNET) has separate address assignments. To accommodate both layers, each router maintains two tables--a routing table and an arp table. The routing table is used to determine how to route to a remote IP address, while the arp table is used to determine what ETHERNET address needs to be used to get to the give IP address.
In a single router configuration, any host on a LAN when attempting to send a packet to another host on another LAN consults its routing table to determine whether the remote host is on the same subnet and, if not, to which intervening router it needs to send a packet. The route which it finds in this case will be a default route which names one of the routers as a "gateway". However, to ensure delivery of the packet, the host on the first LAN must determine the router's ETHERNET address, and does so by consulting its arp table.
This operation is valid for so long as the intervening router continues to be operational. If the router fails, the presence of the second router is of no consequence unless all hosts are able to change their routing and arp tables to reflect the change in availability. The router products available from cisco Systems, Inc., incorporate a Gateway Discovery Protocol (GDP) to enable such a change. Details on this protocol may be found in the publication available from cisco Systems, Inc., entitled ROUTER PRODUCTS CONFIGURATION AND REFERENCE.
When the Gateway Discovery Protocol is enabled, each router is configured to broadcast a GDP report message indicating its availability on the XRC and ARB LANs. This message is broadcast periodically unless configured otherwise. To enable the Gateway Discovery Protocol, an entry must be made in the router configuration for each port attached to LANs on which hosts running an associated GDP daemon process (gdpd) reside.
Thus, in the preferred embodiment, a designated host on each LAN serving an XRC or arbitrator computer runs a gdpd which receives the GDP report messages and maintains a list of routers from which these messages are received. Entries on this list may be aged and purged. If the gdpd of a host does not receive a GDP report message from a router within an aging interval, it clears the router entry from its interval tables, deletes the router from a kernel routing table and clears a kernel arp table. Any existing connections which hosts have to other hosts via the purged route/arp entries undergo "rediscovery" and are routed by way of the second router. The rediscovery steps include having the default route changed to point to the new router by gdpd and obtaining a new arp by broadcasting an arp request and receiving the second router's response.
Although the present invention has been described with reference to a specific preferred embodiment, it will be manifest to those skilled in the art that various changes in form and detail may be made to it without departing from its spirit and scope. For example, specific user connectivity data structures have been described. These structures are necessary to restart the distribution of securities transaction information when a database computer facility fails. In fact, the 1-for-N redundancy architecture of the invention may be practiced using other data structures for other purposes which provide routing information between a serving computer facility and a set of users through a communication structure.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4347563 *||Jun 16, 1980||Aug 31, 1982||Forney Engineering Company||Industrial control system|
|US4412287 *||Sep 15, 1982||Oct 25, 1983||Braddock Iii Walter D||Automated stock exchange|
|US4486853 *||Apr 1, 1981||Dec 4, 1984||Telemet American, Inc.||Apparatus for receiving and displaying continuously updated data|
|US4630196 *||Apr 13, 1983||Dec 16, 1986||At&T Information Systems, Inc.||Store and forward facility for use in multiprocessing environment|
|US4634110 *||Jul 28, 1983||Jan 6, 1987||Harris Corporation||Fault detection and redundancy management system|
|US4685125 *||Jun 28, 1982||Aug 4, 1987||American Telephone And Telegraph Company||Computer system with tasking|
|US4686620 *||Jul 26, 1984||Aug 11, 1987||American Telephone And Telegraph Company, At&T Bell Laboratories||Database backup method|
|US4710926 *||Dec 27, 1985||Dec 1, 1987||American Telephone And Telegraph Company, At&T Bell Laboratories||Fault recovery in a distributed processing system|
|US4800485 *||Jun 16, 1986||Jan 24, 1989||American Telephone And Telegraph Company||On-line documentation facility|
|US4805134 *||Jan 9, 1986||Feb 14, 1989||International Business Machines Corporation||Electronic system for accessing graphical and textual information|
|US4823256 *||Jun 22, 1984||Apr 18, 1989||American Telephone And Telegraph Company, At&T Bell Laboratories||Reconfigurable dual processor system|
|US4868818 *||Oct 29, 1987||Sep 19, 1989||The United States Of America As Represented By The Administrator Of The National Aeronautics And Space Administration||Fault tolerant hypercube computer system architecture|
|US4894828 *||Dec 22, 1987||Jan 16, 1990||Amdahl Corporation||Multiple sup swap mechanism|
|US4933838 *||Jun 3, 1987||Jun 12, 1990||The Boeing Company||Segmentable parallel bus for multiprocessor computer systems|
|US4945474 *||Apr 8, 1988||Jul 31, 1990||Internatinal Business Machines Corporation||Method for restoring a database after I/O error employing write-ahead logging protocols|
|US4949248 *||Jul 15, 1988||Aug 14, 1990||Caro Marshall A||System for shared remote access of multiple application programs executing in one or more computers|
|US4975838 *||Apr 9, 1987||Dec 4, 1990||Hitachi, Ltd.||Duplex data processing system with programmable bus configuration|
|US5056077 *||Mar 2, 1990||Oct 8, 1991||Pioneer Electronic Corporation||Centering mechanism for automotive disc player|
|US5058105 *||Apr 4, 1990||Oct 15, 1991||At&T Bell Laboratories||Network alternate routing arrangement|
|US5084824 *||Mar 29, 1990||Jan 28, 1992||National Semiconductor Corporation||Simulation model generation from a physical data base of a combinatorial circuit|
|US5086429 *||Apr 10, 1990||Feb 4, 1992||Honeywell Inc.||Fault-tolerant digital computing system with reduced memory redundancy|
|US5109384 *||Feb 27, 1990||Apr 28, 1992||Tseung Lawrence C N||Guaranteed reliable broadcast network|
|US5117352 *||Oct 20, 1989||May 26, 1992||Digital Equipment Corporation||Mechanism for fail-over notification|
|US5117422 *||Jul 9, 1990||May 26, 1992||Itt Corporation||Method for providing an efficient and adaptive management of message routing in a multi-platform and apparatus communication system|
|US5123099 *||Jul 15, 1988||Jun 16, 1992||Fujitsu Ltd.||Hot standby memory copy system|
|US5136498 *||Sep 26, 1990||Aug 4, 1992||Honeywell Inc.||Method for enacting failover of a 1:1 redundant pair of slave processors|
|US5140685 *||Sep 16, 1991||Aug 18, 1992||Unisys Corporation||Record lock processing for multiprocessing data system with majority voting|
|US5146452 *||Oct 26, 1990||Sep 8, 1992||Alcatel Network Systems, Inc.||Method and apparatus for rapidly restoring a communication network|
|US5167035 *||Feb 13, 1992||Nov 24, 1992||Digital Equipment Corporation||Transferring messages between nodes in a network|
|US5170480 *||Sep 25, 1989||Dec 8, 1992||International Business Machines Corporation||Concurrently applying redo records to backup database in a log sequence using single queue server per queue at a time|
|US5182744 *||Jan 3, 1991||Jan 26, 1993||At&T Bell Laboratories||Telecommunications network restoration architecture|
|US5224094 *||Feb 11, 1991||Jun 29, 1993||Motorola, Inc.||Communication system network that includes full duplex conference calling|
|US5228038 *||Mar 11, 1991||Jul 13, 1993||Motorola Inc.||Communication system network that includes a BIM status update method|
|US5274630 *||Feb 4, 1991||Dec 28, 1993||Motorola||Communication system network that includes a method for maintaining a system data database|
|US5297262 *||Oct 21, 1992||Mar 22, 1994||International Business Machines Corporation||Methods and apparatus for dynamically managing input/output (I/O) connectivity|
|US5307481 *||Feb 25, 1991||Apr 26, 1994||Hitachi, Ltd.||Highly reliable online system|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US5533191 *||May 4, 1995||Jul 2, 1996||Nec Corporation||Computer system comprising a plurality of terminal computers capable of backing up one another on occurrence of a fault|
|US5661719 *||Oct 19, 1995||Aug 26, 1997||Ncr Corporation||Method for activating a backup network management station in a network management system|
|US5675723 *||May 19, 1995||Oct 7, 1997||Compaq Computer Corporation||Multi-server fault tolerance using in-band signalling|
|US5682470 *||Sep 1, 1995||Oct 28, 1997||International Business Machines Corporation||Method and system for achieving collective consistency in detecting failures in a distributed computing system|
|US5696895 *||Jun 19, 1995||Dec 9, 1997||Compaq Computer Corporation||Fault tolerant multiple network servers|
|US5721904 *||Dec 14, 1994||Feb 24, 1998||Hitachi, Ltd.||Database access system and method of controlling access management to a database access system for a plurality of heterogeneous database servers using SQL|
|US5734810 *||Jul 5, 1995||Mar 31, 1998||Hitachi, Ltd.||Client server system performing automatic reconnection and control method thereof|
|US5737514 *||Nov 29, 1995||Apr 7, 1998||Texas Micro, Inc.||Remote checkpoint memory system and protocol for fault-tolerant computer system|
|US5745672 *||Nov 29, 1995||Apr 28, 1998||Texas Micro, Inc.||Main memory system and checkpointing protocol for a fault-tolerant computer system using a read buffer|
|US5757642 *||Jun 27, 1997||May 26, 1998||Dell Usa L.P.||Multi-function server input/output subsystem and method|
|US5765153 *||Jan 3, 1996||Jun 9, 1998||International Business Machines Corporation||Information handling system, method, and article of manufacture including object system authorization and registration|
|US5787243 *||Jul 2, 1996||Jul 28, 1998||Texas Micro, Inc.||Main memory system and checkpointing protocol for fault-tolerant computer system|
|US5805785 *||Feb 27, 1996||Sep 8, 1998||International Business Machines Corporation||Method for monitoring and recovery of subsystems in a distributed/clustered system|
|US5809506 *||Jan 22, 1996||Sep 15, 1998||International Business Machines Corporation||Method for creating an object base of persisent application objects in an object oriented programming environment and apparatus related thereto|
|US5812748 *||May 16, 1995||Sep 22, 1998||Vinca Corporation||Method for improving recovery performance from hardware and software errors in a fault-tolerant computer system|
|US5852724 *||Jun 18, 1996||Dec 22, 1998||Veritas Software Corp.||System and method for "N" primary servers to fail over to "1" secondary server|
|US5864657 *||Nov 29, 1995||Jan 26, 1999||Texas Micro, Inc.||Main memory system and checkpointing protocol for fault-tolerant computer system|
|US5867708 *||Nov 20, 1995||Feb 2, 1999||International Business Machines Corporation||System, method, and article of manufacture for adding concurrency to a binary class in an object oriented system|
|US5873092 *||Dec 14, 1995||Feb 16, 1999||International Business Machines Corporation||Information handling system, method, and article of manufacture including persistent, distributed object name services including shared properties|
|US5878428 *||Nov 20, 1995||Mar 2, 1999||International Business Machines Corporation||System, method, and article of manufacture for adding transactional recovery to a binary class in an object oriented system|
|US5909540 *||May 2, 1997||Jun 1, 1999||Mangosoft Corporation||System and method for providing highly available data storage using globally addressable memory|
|US5917997 *||Dec 6, 1996||Jun 29, 1999||International Business Machines Corporation||Host identity takeover using virtual internet protocol (IP) addressing|
|US5918227 *||May 6, 1996||Jun 29, 1999||Switchboard, Inc.||On-line directory service with a plurality of databases and processors|
|US5918229 *||Mar 28, 1997||Jun 29, 1999||Mangosoft Corporation||Structured data storage using globally addressable memory|
|US5926619 *||Jan 5, 1998||Jul 20, 1999||International Business Machines Corporation||Apparatus and program product for recovery of a name server managing membership of a domain of processors in a distributed computing environment|
|US5958070 *||Apr 6, 1998||Sep 28, 1999||Texas Micro, Inc.||Remote checkpoint memory system and protocol for fault-tolerant computer system|
|US5974562 *||Dec 5, 1995||Oct 26, 1999||Ncr Corporation||Network management system extension|
|US5978565 *||Apr 28, 1997||Nov 2, 1999||Vinca Corporation||Method for rapid recovery from a network file server failure including method for operating co-standby servers|
|US5987506 *||May 2, 1997||Nov 16, 1999||Mangosoft Corporation||Remote access and geographically distributed computers in a globally addressable storage environment|
|US6012150 *||Mar 27, 1997||Jan 4, 2000||International Business Machines Corporation||Apparatus for synchronizing operator initiated commands with a failover process in a distributed processing system|
|US6032267 *||Aug 14, 1997||Feb 29, 2000||Compaq Computer Corporation||Apparatus and method for efficient modularity in a parallel, fault tolerant, message based operating system|
|US6032271 *||Jun 5, 1996||Feb 29, 2000||Compaq Computer Corporation||Method and apparatus for identifying faulty devices in a computer system|
|US6079030 *||May 25, 1999||Jun 20, 2000||Kabushiki Kaisha Toshiba||Memory state recovering apparatus|
|US6148416 *||May 9, 1997||Nov 14, 2000||Kabushiki Kaisha Toshiba||Memory update history storing apparatus and method for restoring contents of memory|
|US6199065 *||May 14, 1998||Mar 6, 2001||International Computers Limited||Online information delivery system including replicated sites from which information can be delivered|
|US6199172 *||Feb 6, 1996||Mar 6, 2001||Cabletron Systems, Inc.||Method and apparatus for testing the responsiveness of a network device|
|US6199179 *||Jun 10, 1998||Mar 6, 2001||Compaq Computer Corporation||Method and apparatus for failure recovery in a multi-processor computer system|
|US6260068||Jun 10, 1998||Jul 10, 2001||Compaq Computer Corporation||Method and apparatus for migrating resources in a multi-processor computer system|
|US6260155||May 1, 1998||Jul 10, 2001||Quad Research||Network information server|
|US6311169||Jun 11, 1998||Oct 30, 2001||Consumer Credit Associates, Inc.||On-line consumer credit data reporting system|
|US6332180||Jun 10, 1998||Dec 18, 2001||Compaq Information Technologies Group, L.P.||Method and apparatus for communication in a multi-processor computer system|
|US6381682||Jun 10, 1998||Apr 30, 2002||Compaq Information Technologies Group, L.P.||Method and apparatus for dynamically sharing memory in a multiprocessor system|
|US6460144 *||Aug 30, 1999||Oct 1, 2002||International Computers Limited||Resilience in a multi-computer system|
|US6496940 *||Jun 7, 1995||Dec 17, 2002||Compaq Computer Corporation||Multiple processor system with standby sparing|
|US6542926||Jun 10, 1998||Apr 1, 2003||Compaq Information Technologies Group, L.P.||Software partitioned multi-processor system with flexible resource sharing levels|
|US6560617||Mar 18, 1999||May 6, 2003||Legato Systems, Inc.||Operation of a standby server to preserve data stored by a network server|
|US6574748 *||Jun 16, 2000||Jun 3, 2003||Bull Hn Information Systems Inc.||Fast relief swapping of processors in a data processing system|
|US6633916||Jun 10, 1998||Oct 14, 2003||Hewlett-Packard Development Company, L.P.||Method and apparatus for virtual resource handling in a multi-processor computer system|
|US6647393||May 2, 1997||Nov 11, 2003||Mangosoft Corporation||Dynamic directory service|
|US6647508||Jun 10, 1998||Nov 11, 2003||Hewlett-Packard Development Company, L.P.||Multiprocessor computer architecture with multiple operating system instances and software controlled resource allocation|
|US6782538||Dec 14, 1995||Aug 24, 2004||International Business Machines Corporation||Object oriented information handling system including an extensible instance manager|
|US6799224||Mar 10, 1999||Sep 28, 2004||Quad Research||High speed fault tolerant mass storage network information server|
|US6802062 *||May 10, 2000||Oct 5, 2004||Hitachi, Ltd.||System with virtual machine movable between virtual machine systems and control method|
|US6947982 *||Oct 11, 2000||Sep 20, 2005||I2 Technologies Us, Inc.||Distributed session services|
|US7058696||Nov 1, 2000||Jun 6, 2006||Mangosoft Corporation||Internet-based shared file service with native PC client access and semantics|
|US7076608 *||Dec 2, 2003||Jul 11, 2006||Oracle International Corp.||Invalidating cached data using secondary keys|
|US7127442||Apr 1, 2003||Oct 24, 2006||Avaya Technology Corp.||Ironclad notification of license errors|
|US7136903||Nov 1, 2000||Nov 14, 2006||Mangosoft Intellectual Property, Inc.||Internet-based shared file service with native PC client access and semantics and distributed access control|
|US7216363||Aug 30, 2002||May 8, 2007||Avaya Technology Corp.||Licensing duplicated systems|
|US7228567||Aug 30, 2002||Jun 5, 2007||Avaya Technology Corp.||License file serial number tracking|
|US7260557||Feb 27, 2003||Aug 21, 2007||Avaya Technology Corp.||Method and apparatus for license distribution|
|US7263476||Jun 12, 2000||Aug 28, 2007||Quad Research||High speed information processing and mass storage system and method, particularly for information and application servers|
|US7272500||Mar 25, 2004||Sep 18, 2007||Avaya Technology Corp.||Global positioning system hardware key for software licenses|
|US7325158||Oct 3, 2001||Jan 29, 2008||Alcatel||Method and apparatus for providing redundancy in a data processing system|
|US7353388||Feb 9, 2004||Apr 1, 2008||Avaya Technology Corp.||Key server for securing IP telephony registration, control, and maintenance|
|US7373657||Mar 10, 2003||May 13, 2008||Avaya Technology Corp.||Method and apparatus for controlling data and software access|
|US7389312||Jun 26, 2001||Jun 17, 2008||Emc Corporation||Mirroring network data to establish virtual storage area network|
|US7472038||Apr 16, 2007||Dec 30, 2008||International Business Machines Corporation||Method of predicting microprocessor lifetime reliability using architecture-level structure-aware techniques|
|US7475284 *||Mar 17, 2006||Jan 6, 2009||Oki Electric Industry Co., Ltd.||Redundancy system having synchronization function and synchronization method for redundancy system|
|US7584131||Jul 31, 2002||Sep 1, 2009||Ameriprise Financial, Inc.||Method for migrating financial and indicative plan data between computerized record keeping systems without a blackout period|
|US7584146||Sep 19, 2001||Sep 1, 2009||Innovis Data Solutions, Inc.||Consumer credit data storage system|
|US7681245||Aug 30, 2002||Mar 16, 2010||Avaya Inc.||Remote feature activator feature extraction|
|US7698225||Aug 30, 2002||Apr 13, 2010||Avaya Inc.||License modes in call processing|
|US7707116||Aug 30, 2002||Apr 27, 2010||Avaya Inc.||Flexible license file feature controls|
|US7707405||Sep 21, 2004||Apr 27, 2010||Avaya Inc.||Secure installation activation|
|US7747851||Sep 30, 2004||Jun 29, 2010||Avaya Inc.||Certificate distribution via license files|
|US7770062||Nov 26, 2008||Aug 3, 2010||Oki Electric Industry Co., Ltd.||Redundancy system having synchronization function and synchronization method for redundancy system|
|US7814023||Sep 8, 2005||Oct 12, 2010||Avaya Inc.||Secure download manager|
|US7844572||Oct 30, 2007||Nov 30, 2010||Avaya Inc.||Remote feature activator feature extraction|
|US7885896||Jul 9, 2002||Feb 8, 2011||Avaya Inc.||Method for authorizing a substitute software license server|
|US7890997||Jan 20, 2003||Feb 15, 2011||Avaya Inc.||Remote feature activation authentication file system|
|US7913301||Oct 30, 2006||Mar 22, 2011||Avaya Inc.||Remote feature activation authentication file system|
|US7965701||Apr 29, 2005||Jun 21, 2011||Avaya Inc.||Method and system for secure communications with IP telephony appliance|
|US7966520 *||Aug 30, 2002||Jun 21, 2011||Avaya Inc.||Software licensing for spare processors|
|US8041642||Jul 10, 2002||Oct 18, 2011||Avaya Inc.||Predictive software license balancing|
|US8046362||Apr 24, 2009||Oct 25, 2011||Lexisnexis Risk & Information Analytics Group, Inc.||Statistical record linkage calibration for reflexive and symmetric distance measures at the field and field value levels without the need for human interaction|
|US8090733||Jul 2, 2009||Jan 3, 2012||Lexisnexis Risk & Information Analytics Group, Inc.||Statistical measure and calibration of search criteria where one or both of the search criteria and database is incomplete|
|US8135679||Apr 24, 2009||Mar 13, 2012||Lexisnexis Risk Solutions Fl Inc.||Statistical record linkage calibration for multi token fields without the need for human interaction|
|US8135680||Apr 24, 2009||Mar 13, 2012||Lexisnexis Risk Solutions Fl Inc.||Statistical record linkage calibration for reflexive, symmetric and transitive distance measures at the field and field value levels without the need for human interaction|
|US8135681||Apr 24, 2009||Mar 13, 2012||Lexisnexis Risk Solutions Fl Inc.||Automated calibration of negative field weighting without the need for human interaction|
|US8135719||Apr 24, 2009||Mar 13, 2012||Lexisnexis Risk Solutions Fl Inc.||Statistical record linkage calibration at the field and field value levels without the need for human interaction|
|US8140719||May 5, 2009||Mar 20, 2012||Sea Micro, Inc.||Dis-aggregated and distributed data-center architecture using a direct interconnect fabric|
|US8181061 *||Apr 19, 2010||May 15, 2012||Microsoft Corporation||Memory management and recovery for datacenters|
|US8190616||Jul 2, 2009||May 29, 2012||Lexisnexis Risk & Information Analytics Group Inc.||Statistical measure and calibration of reflexive, symmetric and transitive fuzzy search criteria where one or both of the search criteria and database is incomplete|
|US8195670||Apr 24, 2009||Jun 5, 2012||Lexisnexis Risk & Information Analytics Group Inc.||Automated detection of null field values and effectively null field values|
|US8195780||Aug 18, 2003||Jun 5, 2012||Reuters, Ltd.||Market data domain and enterprise system implemented by a master entitlement processor|
|US8229858||Feb 4, 2005||Jul 24, 2012||Avaya Inc.||Generation of enterprise-wide licenses in a customer environment|
|US8250078||Apr 24, 2009||Aug 21, 2012||Lexisnexis Risk & Information Analytics Group Inc.||Statistical record linkage calibration for interdependent fields without the need for human interaction|
|US8266168||Aug 8, 2008||Sep 11, 2012||Lexisnexis Risk & Information Analytics Group Inc.||Database systems and methods for linking records and entity representations with sufficiently high confidence|
|US8275770||Apr 24, 2009||Sep 25, 2012||Lexisnexis Risk & Information Analytics Group Inc.||Automated selection of generic blocking criteria|
|US8285725||Jul 2, 2009||Oct 9, 2012||Lexisnexis Risk & Information Analytics Group Inc.||System and method for identifying entity representations based on a search query using field match templates|
|US8316047||Apr 24, 2009||Nov 20, 2012||Lexisnexis Risk Solutions Fl Inc.||Adaptive clustering of records and entity representations|
|US8396830 *||Dec 21, 2007||Mar 12, 2013||Hitachi, Ltd.||Data control method for duplicating data between computer systems|
|US8447833||Mar 6, 2012||May 21, 2013||Microsoft Corporation||Reading and writing during cluster growth phase|
|US8484168||Mar 12, 2012||Jul 9, 2013||Lexisnexis Risk & Information Analytics Group, Inc.||Statistical record linkage calibration for multi token fields without the need for human interaction|
|US8484211||Jul 2, 2009||Jul 9, 2013||Lexisnexis Risk Solutions Fl Inc.||Batch entity representation identification using field match templates|
|US8489617||Jun 5, 2012||Jul 16, 2013||Lexisnexis Risk Solutions Fl Inc.||Automated detection of null field values and effectively null field values|
|US8495076||Nov 18, 2011||Jul 23, 2013||Lexisnexis Risk Solutions Fl Inc.||Statistical measure and calibration of search criteria where one or both of the search criteria and database is incomplete|
|US8495077||Jul 11, 2012||Jul 23, 2013||Lexisnexis Risk Solutions Fl Inc.||Database systems and methods for linking records and entity representations with sufficiently high confidence|
|US8533299||Apr 19, 2010||Sep 10, 2013||Microsoft Corporation||Locator table and client library for datacenters|
|US8572052||Mar 12, 2012||Oct 29, 2013||LexisNexis Risk Solution FL Inc.||Automated calibration of negative field weighting without the need for human interaction|
|US8572070||Jul 2, 2009||Oct 29, 2013||LexisNexis Risk Solution FL Inc.||Statistical measure and calibration of internally inconsistent search criteria where one or both of the search criteria and database is incomplete|
|US8620819||Oct 30, 2009||Dec 31, 2013||Avaya Inc.||Remote feature activator feature extraction|
|US8639691||Jul 2, 2009||Jan 28, 2014||Lexisnexis Risk Solutions Fl Inc.||System for and method of partitioning match templates|
|US8639705||Jul 2, 2009||Jan 28, 2014||Lexisnexis Risk Solutions Fl Inc.||Technique for recycling match weight calculations|
|US8661026||Jul 2, 2009||Feb 25, 2014||Lexisnexis Risk Solutions Fl Inc.||Entity representation identification using entity representation level information|
|US8676843 *||Nov 14, 2002||Mar 18, 2014||LexiNexis Risk Data Management Inc.||Failure recovery in a parallel-processing database system|
|US8843502||Jun 24, 2011||Sep 23, 2014||Microsoft Corporation||Sorting a dataset of incrementally received data|
|US8996611||Jan 31, 2011||Mar 31, 2015||Microsoft Technology Licensing, Llc||Parallel serialization of request processing|
|US9015171||Dec 14, 2009||Apr 21, 2015||Lexisnexis Risk Management Inc.||Method and system for linking and delinking data records|
|US9020971||Sep 17, 2013||Apr 28, 2015||Lexisnexis Risk Solutions Fl Inc.||Populating entity fields based on hierarchy partial resolution|
|US9031979||Sep 17, 2013||May 12, 2015||Lexisnexis Risk Solutions Fl Inc.||External linking based on hierarchical level weightings|
|US9037606||Sep 17, 2013||May 19, 2015||Lexisnexis Risk Solutions Fl Inc.||Internal linking co-convergence using clustering with hierarchy|
|US9043359||Sep 17, 2013||May 26, 2015||Lexisnexis Risk Solutions Fl Inc.||Internal linking co-convergence using clustering with no hierarchy|
|US9081653||Mar 14, 2013||Jul 14, 2015||Flextronics Ap, Llc||Duplicated processing in vehicles|
|US20040078339 *||Oct 22, 2002||Apr 22, 2004||Goringe Christopher M.||Priority based licensing|
|US20040098371 *||Nov 14, 2002||May 20, 2004||David Bayliss||Failure recovery in a parallel-processing database system|
|US20040128551 *||Jan 20, 2003||Jul 1, 2004||Walker William T.||Remote feature activation authentication file system|
|US20040172367 *||Feb 27, 2003||Sep 2, 2004||Chavez David L.||Method and apparatus for license distribution|
|US20040181696 *||Mar 11, 2003||Sep 16, 2004||Walker William T.||Temporary password login|
|US20040199760 *||Apr 1, 2003||Oct 7, 2004||Mazza Bruce P.||Ironclad notification of license errors|
|US20050120181 *||Dec 2, 2003||Jun 2, 2005||Oracle International Corporation||Invalidating cached data using secondary keys|
|US20050193059 *||Apr 28, 2005||Sep 1, 2005||Richard Dellacona||High speed fault tolerant mass storage network information server|
|US20050203989 *||May 9, 2005||Sep 15, 2005||Richard Dellacona||High speed information processing and mass storage system and method, particularly for information and application servers|
|US20050223146 *||Feb 4, 2005||Oct 6, 2005||Richard Dellacona||High speed information processing and mass storage system and method, particularly for information and application servers|
|US20110208844 *||Aug 25, 2011||Huawei Technologies Co., Ltd.||Cluster system, method and device for expanding cluster system|
|EP0974903A2 *||Jul 12, 1999||Jan 26, 2000||Academia Sinica||Method and apparatus for providing failure detection and recovery with predetermined replication style for distributed applications in a network|
|EP0981089A2 *||Jul 12, 1999||Feb 23, 2000||Academia Sinica||Method and apparatus for providing failure detection and recovery with predetermined degree of replication for distributed applications in a network|
|EP1195678A2 *||Oct 1, 2001||Apr 10, 2002||Alcatel Alsthom Compagnie Generale D'electricite||Operating method for a data processing system with a redundant processing unit|
|WO2001098902A1 *||May 11, 2001||Dec 27, 2001||Bull Hn Information Syst||Fast relief swapping of processors in a data processing system|
|WO2004059484A1 *||Dec 31, 2002||Jul 15, 2004||Cunjun Dai||A method of standby and controlling load in distributed data processing system|
|U.S. Classification||714/10, 714/E11.174, 714/E11.094, 714/E11.072, 707/999.204, 707/999.202, 714/4.21|
|International Classification||G06F11/20, G06F11/22, G06F11/30, G06F11/273|
|Cooperative Classification||Y10S707/99955, Y10S707/99953, G06F11/3006, G06F11/3055, G06F11/3051, G06F11/2094, G06F11/20, G06F11/22, G06F11/2736, G06F11/2097, G06F11/2041, G06F11/2025|
|European Classification||G06F11/273S, G06F11/20P8|
|Oct 29, 1993||AS||Assignment|
Owner name: QUOTRON SYSTEMS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:FLANAGAN, DOUGLAS;KUI, PETER Y.;BESHEARS, NORMAN J.;REEL/FRAME:006744/0403;SIGNING DATES FROM 19930902 TO 19931006
|Sep 26, 1995||CC||Certificate of correction|
|Nov 3, 1995||AS||Assignment|
Owner name: REUTERS LIMITED, ENGLAND
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:QUOTRON SYSTEMS, INC.;REEL/FRAME:007690/0114
Effective date: 19950920
|Oct 19, 1998||FPAY||Fee payment|
Year of fee payment: 4
|Oct 26, 1998||AS||Assignment|
Owner name: REUTERS, LTD., ENGLAND
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:DEVELOPMENT AND SUPPORT QUOTRON SYSTEMS, INC.;REEL/FRAME:009547/0378
Effective date: 19981001
|Nov 6, 2002||REMI||Maintenance fee reminder mailed|
|Mar 31, 2003||SULP||Surcharge for late payment|
Year of fee payment: 7
|Mar 31, 2003||FPAY||Fee payment|
Year of fee payment: 8
|Sep 29, 2006||FPAY||Fee payment|
Year of fee payment: 12
|Jun 22, 2015||AS||Assignment|
Owner name: THOMSON REUTERS GLOBAL RESOURCES, SWITZERLAND
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:REUTERS LIMITED;REEL/FRAME:035874/0617
Effective date: 20150619